On 15 September 2026, Norwegian police announced that Telenor ASA, the Norwegian parent of the operator that once ran Telenor Myanmar, has been charged in two separate investigations linked to its Myanmar business. According to the joint press release from Kripos and PST (Norway’s national criminal investigation service and its domestic security service), published on 15 September 2026, Kripos is investigating suspected complicity in crimes against humanity, and PST is investigating a suspected breach of sanctions law. Officers also searched Telenor’s headquarters at Fornebu the same day under Oslo District Court orders.
Telenor Myanmar is today’s ATOM, a mobile operator whose SIM cards many readers of this site use every day. That is why this is a Myanmar tech story and not only a Norwegian corporate one. This article sets out what the police say, what Telenor says in reply, and what the case does not say. It also explains why the type of data at the centre of it matters, and what questions it raises for readers who carry a SIM card in Myanmar today. Every claim below is attributed to the source it comes from, and none of it is a finding by a court.
What did Norwegian police actually charge Telenor with?
There are two separate tracks, and the company named in both is Telenor ASA.
- Kripos (complicity in crimes against humanity). The police release covers the period from 1 February 2021, the day of the coup, to 25 March 2022, when the sale of Telenor Myanmar Ltd was completed. It says the Myanmar subsidiary repeatedly handed historical customer traffic data to the military regime while the regime carried out extensive abuses against parts of the civilian population.
- PST (sanctions breach). PST’s case is that the sale of Telenor Myanmar included sanctioned surveillance equipment and that no permission was obtained from the Norwegian Foreign Ministry.
Two limits matter. First, according to Telenor’s own press release of 15 September 2026, no individuals have been charged or are under investigation. News in English reported the same on the day, quoting the prosecutors: no other group companies or private persons have been charged so far. Second, this is a charge and not a conviction. The Norwegian term used in the headlines, siktet, describes someone formally treated as a suspect. It is an early stage of a process. No court has ruled, and we are not describing Telenor as guilty of anything.
What does Telenor say, and where do the prosecutors push back?
Telenor confirmed in its statement that it was informed of the investigation and charges on 15 September, that police searched its Fornebu premises, that it has handed over extensive documentation, and that it will co-operate fully. It also disputes the premise. In the words of its Media Relations Director, David Fidjeland: “Our employees risked imprisonment, torture or the death penalty if the military authorities’ orders were not complied with… we found that we had no real choice and that we could not put our employees’ lives at risk.” The company added that this is a complex case that has also been investigated by the police before.
The prosecutors did not dismiss that argument. According to NRK’s report from the press conference (our translation of the Norwegian, so treat the wording as NRK’s rendering), Kripos attorney Espen Hjelmeland Hanken said neither Kripos nor PST doubts that Telenor was in a “very demanding situation” after the coup. But “even in very difficult situations there are limits to what one can lawfully do,” he said, and the threshold for invoking necessity in such a serious case “will be high”. He also said the charge means Kripos sees a basis for placing possible criminal liability on Telenor ASA itself, and that it considers it probable that people at several levels in both Telenor Myanmar and Telenor ASA were involved in handling the regime’s requests for customer information.
Read together, the two positions show where the dispute will be. Nobody, on the record, is saying the pressure on staff in Myanmar was imaginary. The argument is about whether that pressure legally excuses what was handed over.
Why was metadata enough to matter?
The police release speaks of “historical traffic data”. For a technology audience, the important detail is what that meant in practice. NRK’s 2025 investigation, summarised again in its 2026 explainer, reported that the data handed over on the military’s direct demand for more than 1,300 customers consisted of call logs, names, addresses and last known location. NRK describes it as metadata, and the items it lists do not include the content of calls or messages.
That distinction is easy to misread as reassurance. It is closer to the opposite. A call log shows who spoke to whom, when, and for how long. Registration records tie a phone number to a real name and home address. A last known location comes from which cell tower a handset most recently connected to. Together, these let an analyst map a person’s contacts and movements without ever listening to a single call. Encryption on messaging apps does not touch any of it, because the network operator holds this data simply by running the network.
NRK also reported that internal Telenor analyses warned that nearly 500 customers were at risk of arrest, and that metadata on the elected politician Phyo Zeya Thaw was handed over only weeks before he was located, arrested and later executed. These are NRK’s findings from documents it obtained, and we present them as such. Telenor confirmed to NRK that it handed over sensitive information but says it had no choice. NRK also says it found an internal letter that contradicts Telenor’s claim that it never prepared surveillance equipment, while Telenor has always maintained that its lawful-interception equipment was never activated by the company itself.
How many people were affected? Three different numbers
The coverage contains several figures that should not be blended:
- More than 1,300 customers: NRK’s count of people whose metadata it found was handed over on the military’s direct demand.
- More than 18 million people: a claim by human rights experts, reported by The Record, that the sale handed the buyer the historical call data of that many people. This is not a police finding.
- Roughly 1,200 claimants: according to The Record, a class action was filed in April on behalf of 1,200 people whose data was allegedly shared with the military. DatacenterDynamics also reports the class action, citing a statement from the Swedish non-profit Justice and Accountability Initiative, but gives no claimant figure. Neither report is clear enough for us to say which organisation is the filing party, so we do not name one. Separately, as Al Jazeera reported in October 2025, a civil-society coalition backed by the Netherlands-based group SOMO had sent Telenor a notice of intent to sue. Their lawyer said Telenor “should have deleted all sensitive data before selling its operations”, and Telenor answered that it faced a “terrible and tragic situation” with “no good options”.
The gap between 1,300 and 18 million is the whole story of the case in miniature. One number is about specific handovers on specific demands. The other is about what the customer database as a whole could offer to a new owner. The police charge, as worded in their release, is about repeated handovers of historical traffic data. It is not built on the 18 million figure.
How does the 2022 sale fit in, and what did we report at the time?
Telenor sold its Myanmar business to Lebanon’s M1 Group. DatacenterDynamics reports the price as US$105 million. That figure comes from secondary reporting only, and we have not been able to confirm it against a primary document. According to The Record, M1 then sold 80 percent to Shwe Byain Phyu (spelled Shwe Byine Phyu by Eleven Media), a company run by allies of the military government. The business was renamed ATOM in June 2022, a change we noted in our weekly column in August.
We should be candid about our own record. When the deal was announced, we reported it in an article published on 12 July 2021 as an ordinary change of ownership: the buyer takes the licences, spectrum, contracts, employees and customers, subject to regulatory approval. That description was accurate, and it is what the announcement said. Our article also said the customers “will be retained”, a phrase that read as routine at the time. Claimants now argue that the sale gave the military “unfettered access” to customer data (Al Jazeera, October 2025). We are not claiming our announcement said anything about data. The point is that, for a customer base, “the customers transfer to the buyer” and “the customer records transfer to the buyer” can be the same fact. Routine-sounding ownership announcements can carry data consequences that only become visible years later.
What does this case not say about ATOM today?
This needs to be stated plainly, because the names are easy to blur. The charges concern the conduct of Telenor ASA, the Norwegian parent. The Kripos charge covers February 2021 to March 2022, and the PST charge concerns the 2022 sale itself. Neither concerns ATOM’s current conduct. No ATOM entity, executive or current owner has been charged, Telenor says no individuals are charged or under investigation, and prosecutors said at the press conference that no other group companies or private persons have been charged so far. We found no statement on the case from ATOM or from authorities in Myanmar as of 21 September 2026.
Who owns ATOM now is reported differently, and we are not going to settle it here. Coverage of the 2026 case, such as The Record’s, describes the 2022 chain in which Shwe Byain Phyu took 80 percent. ATOM itself said in February 2024, according to Eleven Media, that after US sanctions on that group it cancelled the investment, transferred the shares to Myancom Holding Ltd, and that three directors linked to Shwe Byine Phyu resigned. That is ATOM’s own account, and we have not independently verified it. The two versions have not been reconciled in the coverage we read.
Does the SIM in your pocket today face the same exposure?
We cannot answer that from this case, and we are not going to imply an answer. What we can do is point to what has changed since 2021, as an open question. In recent months we have covered two pieces of infrastructure that tie a person to a device and a number: the CEIR phone registration system, which links handsets by IMEI, and the UID digital ID pilot, a gateway that connects SIMs, bank accounts and passports. Our reading is that the identity and registry layer around a Myanmar SIM is considerably denser than it was in 2021, when Telenor Myanmar’s records were the main place a name met a number.
That is not an accusation against any operator or agency. It is a set of questions that any subscriber may reasonably ask, and that the Norwegian case has made harder to postpone:
- What is logged about a subscriber, and for how long?
- Who can ask an operator for it, under which rule, and is there any record of such requests?
- When a business changes hands, what happens to the old records, and can customers find out?
We have not verified any specific data-retention obligation for Myanmar operators, so we make no claim about what current rules require. The point is that the answers to the questions above are not published in a form an ordinary subscriber can check.
What does the timeline teach us?
The events at issue took place in 2021 and 2022. A first sanctions complaint by Norway’s Foreign Ministry in 2023 was later dropped by PST “based on the state of the evidence”, according to NRK. Justice For Myanmar and ICJ Norway say they filed a complaint on 19 December 2024, which was rejected without investigation, and a further one on 10 October 2025 to a higher prosecutorial authority, extended to cover aiding and abetting crimes against humanity (their press release of 16 September 2026; they are the complainants and an interested party, and DVB reports the same months). Public detail arrived largely through NRK’s 2025 documents. The charges came in September 2026, about four and a half years after the sale closed.
For subscribers, the lesson is about lag. Data decisions taken quickly under pressure may only be examined years later, and by then the people affected have no way to reverse them.
What we will be watching
So this piece can be checked later, here are the specific things we will look for:
- Whether any individual, at Telenor ASA or its former Myanmar subsidiary, is formally charged or named as a suspect. As of 15 September, prosecutors said none had been.
- Whether ATOM or any of its owners issue a public statement on the case. As of 21 September, we found none.
- Whether the civil class action, reportedly on behalf of about 1,200 people, proceeds, and how a court treats Telenor’s “no real choice” argument.
- Whether the Norwegian process produces a public account of what was handed over, to whom, and on what demand, that either confirms or corrects the figures quoted above.
Frequently asked questions
Is Telenor guilty of crimes against humanity?
No court has said so. Norwegian police have charged Telenor ASA, which means prosecutors see a basis to pursue possible criminal liability. Telenor disputes wrongdoing and says it had no real choice because its staff faced threats of imprisonment, torture or the death penalty. Prosecutors have said the threshold for a necessity defence in such a case will be high, while accepting Telenor was in a very demanding situation.
Is ATOM under investigation?
Not according to anything we found. The charges name Telenor ASA only. Telenor says no individuals are charged or under investigation, and prosecutors said no other group companies or private persons have been charged so far. The Kripos charge covers February 2021 to March 2022 and the PST charge concerns the 2022 sale itself, both before the business became ATOM.
What data did Telenor Myanmar allegedly hand to the military?
Police describe it as historical customer traffic data. NRK reported that for more than 1,300 customers it comprised call logs, names, addresses and last known location. The items NRK lists do not include the content of calls or messages. Telenor confirmed to NRK that it handed over sensitive information.
Was the data of 18 million people handed over?
That number is a claim by human rights experts, as reported by The Record, about what the sale transferred to the buyer. It is not a police finding, and it is not the basis of the specific charge. NRK’s documented figure for direct handovers is more than 1,300 customers.
Does this affect my SIM card today?
The charges are about 2021 and 2022 and do not describe current practice at any operator. They do raise a fair question about what is logged and who can request it. We have not verified any current retention rule, so we do not claim to know the answer.
The short version
Norway has charged Telenor ASA in two investigations linked to its Myanmar business: suspected complicity in crimes against humanity and a suspected sanctions breach. Telenor says it had no real choice, and prosecutors accept the pressure was severe while saying the legal bar for necessity is high. The case is at an early stage, with no individual charged and no ruling. For Myanmar readers, its lasting value is less about the verdict than about the data. Metadata was enough, a routine-sounding sale can move it, and the registries around a SIM are thicker now than they were in 2021. We will return to the four watch items above as the process moves.
Sources (all accessed 21 September 2026; publication dates as verified):
Kripos/PST press release, politiet.no, 15 September 2026: https://www.politiet.no/nyheter-og-presse/kripos/nyhet/2026-09-15/pressemelding
Telenor Group press release, 15 September 2026: https://www.telenor.com/media/newsroom/press-releases/investigation-and-charges-in-the-myanmar-case/
NRK, 15 September 2026 (updated 16 September): https://www.nrk.no/artikkel/myanmar-saken-telenor-siktet-for-medvirkning-til-forbrytelse-mot-menneskeheten-1527869
The Record, 15 September 2026: https://therecord.media/norway-investigations-telenor-telecom-myanmar-regime
News in English, 15 September 2026: https://www.newsinenglish.no/2026/09/15/authorities-raid-telenor-offices/
DatacenterDynamics, 15 September 2026: https://www.datacenterdynamics.com/en/news/telenor-under-investigation-over-former-myanmar-unit-amid-suspected-sanctions-breaches/
DVB English, 16 September 2026: https://english.dvb.no/norwegian-police-charge-telenor-over-sanctions-violations-and-complicity-in-crimes-against-humanity-in-myanmar/
Justice For Myanmar and ICJ Norway press release (complainants), 16 September 2026: https://www.justiceformyanmar.org/press-releases/justice-for-myanmar-and-icj-norway-welcome-charges-against-telenor-asa-for-complicity-in-crimes-against-humanity-and-sanctions-breaches
Eleven Media, 10 February 2024 (ATOM’s own statement): https://elevenmyanmar.com/news/atom-scraps-investment-plans-with-shwe-byine-phyu-group
Al Jazeera, 7 October 2025: https://www.aljazeera.com/news/2025/10/7/myanmar-activists-to-sue-norways-telenor-for-handing-data-to-military
Myanmar Tech Press, 12 July 2021: https://en.myanmartechpress.com/telenor-and-m1/
Myanmar Tech Press, CEIR phone registration: https://en.myanmartechpress.com/myanmar-ceir-phone-registration/
Myanmar Tech Press, UID digital ID pilot: https://en.myanmartechpress.com/myanmar-uid-digital-id-pilot/
Myanmar Tech Press, weekly column: https://en.myanmartechpress.com/this-week-in-myanmar-tech-a-5g-deadline-a-sanctioned-vendor-and-a-nine-year-wait/
Quotes from the Norwegian-language sources are our own translations. Figures such as 1,300 customers, about 500 at risk, and 18 million people are the findings or claims of NRK and of rights experts respectively, not findings of a court. The US$105 million sale price comes from secondary reporting only.